build: guard the initial chunks by module id; main-chunk check in CI

Review of Task 0:
- build/initialChunkGuard.js, a Rollup plugin in the browser build, fails
  the build when an initial chunk (an entry and what it imports
  statically) holds a module from node_modules/three, @navaramap/* or
  postprocessing. Checked by forcing it on satellite.js, which the main
  chunk does hold: the build fails naming the chunk and module.
  navaraAssets.test now pins both build plugins.
- scripts/check-main-chunk.mjs is one script for both main-chunk checks:
  the composition (text markers in the initial chunks, sizes) and, when
  scripts/main-chunk-baseline.json exists, the phase-4 branch's gzip-9
  budget, with its exports (checkMainChunk, measureMainChunk) so the two
  branches merge into this file. The composition test moved to
  src/tooling/mainChunkComposition.test.mjs to leave phase 4's
  mainChunk.test.mjs its name.
- CI runs npm run check:main-chunk after each npm run build (unit,
  browser-gate and Windows jobs).

scripts/format-scope.json

@@ -1064,6 +1064,7 @@
   "src/tooling/navaraAssets.test.mjs",
   "src/tooling/tileCache.test.mjs",
   "scripts/check-main-chunk.mjs",
-  "src/tooling/mainChunk.test.mjs",
-  "scripts/qa-w1-baseline.mjs"
+  "src/tooling/mainChunkComposition.test.mjs",
+  "scripts/qa-w1-baseline.mjs",
+  "src/tooling/initialChunkGuard.test.mjs"
 ]